🔒 Privacy Policy

Last Updated: April 10, 2026

📋 Table of Contents

1. 1. Information We Collect ▼ subsections
   • 1.1 Account Information
   • 1.2 Uploaded Content
   • 1.3 Activity Data
   • 1.4 Third-Party Login Data (OAuth)
   • 1.5 Verification Data
   • 1.6 Messaging and Chat Data
   • 1.7 Random Video Chat (Omegle) Data
   • 1.8 Games Data
   • 1.9 Point Shop and Transaction Data
   • 1.10 Donation Data
   • 1.11 Friends and Social Data
   • 1.12 Event and Seasonal Feature Data
   • 1.13 IP Sharing and Multi-Account Detection
   • 1.14 Voting and Interaction Data
   • 1.15 EXIF Data and Embedded Metadata
   • 1.16 Photo Boosting and Purchasing Data
2. 2. How We Use Your Information ▼ subsections
   • 2.1 Automated Processing and AI Moderation
3. 3. Data Retention
4. 4. Data Sharing
5. 5. Your Rights Under GDPR ▼ subsections
   • 5.1 Right of Access
   • 5.2 Right to Rectification
   • 5.3 Right to Erasure
   • 5.4 Right to Restriction
   • 5.5 Right to Data Portability
   • 5.6 Right to Object
   • 5.7 Right to Withdraw Consent
   • 5.8 Right to Lodge a Complaint
   • How to Exercise Your Rights
6. 6. Security
7. 7. International Data Transfers
8. 8. Cookies and Tracking Technologies
9. 9. Legal Basis for Processing
10. 10. Data Protection Officer
11. 11. United States Privacy Rights
12. 12. Contact Us
13. 13. Children's Data Processing
14. 14. Data Breach Notification

1. Information We Collect

1.1 Account Information

• Username and display name
• Email address
• Password (encrypted)
• Date of birth
• Gender and country
• Profile information and bio

1.2 Uploaded Content

• Photos, images, and videos you upload (up to 25 files at once)
• Photo and video titles and descriptions
• Category selections
• Upload timestamps
• Video thumbnails (auto-generated)

1.3 Activity Data

• IP addresses
• Browser type and version
• Device information
• Pages visited and actions taken
• Ratings and votes given
• Login times and session data

1.4 Third-Party Login Data (OAuth)

If you log in via Google or X (Twitter), we receive:

• Your name and email address from the provider
• Your profile picture (used as avatar if you don't have one)
• A unique identifier from the provider (Google ID or X/Twitter ID)

We do not receive your Google or X password, and we do not post to your accounts or access your contacts.

1.5 Verification Data

If you choose to verify your identity, we collect:

• A photo of you holding a paper sign with your username, the site name, and the current date
• The timestamp of your verification submission

1.6 Messaging and Chat Data

• Private messages sent and received between users (content, timestamps, sender/recipient IDs)
• Profile comments left on user profiles
• Message report submissions and outcomes

1.7 Random Video Chat (Omegle) Data

1.8 Games Data

• Game scores and play history (e.g., Super Mario leaderboard entries)
• Truth or Dare answers and responses you submit
• Game session timestamps and participation records

1.9 Point Shop and Transaction Data

• Point Shop purchase history (items purchased, points spent, timestamps)
• Virtual item inventory and usage (e.g., applied profile backgrounds)

1.10 Donation Data

• Donation amounts and timestamps
• Donor username (may be displayed publicly on the donation progress tracker)
• Payment is processed by third-party providers — we do not store your credit card number, bank details, or full payment credentials

1.11 Friends and Social Data

• Friend requests sent and received
• List of accepted friendships
• Friendship status (visible on profiles to other users)

1.12 Event and Seasonal Feature Data

• Content uploaded during seasonal events (e.g., April Fools photo gallery)
• For guest event uploads: IP address, user agent string, and session identifiers
• Event participation timestamps and view counts

1.13 IP Sharing and Multi-Account Detection

1.14 Voting and Interaction Data

• Photo and video ratings (1–10 scale)
• Hot or Not votes
• Favorites and saved content
• Points earned through site activity

1.15 EXIF Data and Embedded Metadata

1.16 Photo Boosting and Purchasing Data

• Photo boost purchase history (which photos were boosted, timestamps, points spent)
• Photo purchase history (photos purchased from other users, timestamps, points spent)
• Boost performance data (views gained during boost period)

2. How We Use Your Information

• To provide and maintain our service
• To verify age requirements
• To prevent fraud and abuse
• To enforce our Terms of Service
• To comply with legal obligations
• To improve user experience
• To communicate with you about your account
• To promote and grow the service (for example, featuring publicly posted content in promotional materials as described in our Terms of Service)
• To operate automated content moderation systems (see Section 2.1)
• To verify user identities through our verification system
• To calculate leaderboard rankings and award points
• To operate the Hot or Not voting feature
• To detect and prevent duplicate or previously-removed content
• To facilitate random video chat (Omegle) matching and moderation
• To operate games, leaderboards, and interactive features
• To process Point Shop purchases and manage virtual item inventories
• To process and display donation contributions
• To detect multi-account usage via IP address correlation
• To operate seasonal and event features (e.g., April Fools gallery)

2.1 Automated Processing and AI Moderation

3. Data Retention

We retain your data:

• Account data: Until you delete your account
• Uploaded content: Until you delete it or we remove it for a policy violation
• Verification photos: Retained for the duration of your account; deleted upon account deletion
• Messages and chat: Until you or the other party deletes them, or upon account deletion
• IP logs: For security and legal compliance (typically 90 days to 1 year)
• Session data: Active sessions expire after inactivity; historical data retained up to 90 days
• Deleted content: May remain in backups for up to 90 days
• Legal hold data: Retained as required by law or valid legal process
• Perceptual hashes: Retained indefinitely to prevent re-upload of removed content

4. Data Sharing

5. Your Rights Under GDPR

As an EU-based service, we provide you with comprehensive data protection rights:

5.1 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether your personal data is being processed and, if so, access to that data and information about the processing.

5.2 Right to Rectification (Art. 16 GDPR)

You have the right to obtain the rectification of inaccurate personal data and to have incomplete data completed.

5.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You have the right to request deletion of your personal data without undue delay where:

• The data is no longer necessary for the purposes collected
• You withdraw consent and there is no other legal ground for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased for compliance with a legal obligation

Note: This right may be limited where retention is necessary for legal compliance, establishment of legal claims, or other lawful purposes.

5.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to restrict processing of your personal data in certain circumstances.

5.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.

5.6 Right to Object (Art. 21 GDPR)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

5.7 Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw consent at any time.

5.8 Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, workplace, or where an alleged infringement occurred.

Finnish Data Protection Authority:
Office of the Data Protection Ombudsman
Website: tietosuoja.fi
Email: tietosuoja@om.fi

How to Exercise Your Rights

To exercise any of these rights, contact us using our Privacy Request Form or Data Protection Officer

We will respond to your request within one month as required by GDPR (extendable by two additional months for complex requests).

6. Security

We implement industry-standard security measures including:

• Encrypted passwords using Argon2ID
• Secure HTTPS connections
• Regular security audits
• Access controls and monitoring

7. International Data Transfers

Data Location: Your data is primarily stored on servers located in Finland (EU).

If we transfer your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions by the EU Commission
• Your explicit consent where required

Currently, data processing occurs within the EU and we do not routinely transfer data outside the EEA.

8. Cookies and Tracking Technologies

Cookie Consent: In compliance with the EU ePrivacy Directive (Cookie Law), we obtain your consent before placing non-essential cookies.

We use cookies for:

• Strictly Necessary Cookies: Session management, authentication, security (no consent required)
• Guest Identification Cookie (guest_id): Used to track guest uploads and prevent duplicate voting without an account (strictly necessary for service operation)
• Functional Cookies: User preferences and settings (consent required)
• Performance Cookies: Analytics and site improvement (consent required)

You can manage your cookie preferences at any time through your browser settings or our cookie consent banner.

9. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): For optional features and marketing communications
• Contract Performance (Art. 6(1)(b) GDPR): To provide our service to you
• Legal Obligations (Art. 6(1)(c) GDPR): For age verification, CSAM reporting, and compliance with Finnish/EU law
• Legitimate Interests (Art. 6(1)(f) GDPR): For security, fraud prevention, abuse prevention, and service improvement
• EU Regulation 2021/1232 (ePrivacy CSAM Derogation): This regulation provides a specific temporary derogation from the confidentiality provisions of the ePrivacy Directive, authorising online platforms to voluntarily use technology to detect, report, remove, and disable access to CSAM in electronic communications including private messages. Our automated message scanning for CSAM and grooming patterns operates under this legal framework

10. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee GDPR compliance.

To contact our DPO or submit privacy requests, please use our Contact Form and select the appropriate category (DPO, GDPR, or Privacy Request).

11. United States Privacy Rights

12. Contact Us

Data Controller: RateMyBody, Finland

For all privacy-related inquiries, please use our Contact Form and select the appropriate category:

• Privacy inquiries: Select "Privacy / GDPR Request"
• Data Protection Officer: Select "Data Protection Officer (DPO)"
• GDPR requests: Select "Privacy / GDPR Request"
• California/CCPA requests: Select "California Privacy Rights (CCPA)"
• DMCA/Copyright: Select "DMCA / Copyright Takedown"

For all inquiries, you can also use our Contact Form.

Legal Entity: RateMyBody operates in Finland under EU law. We do not maintain a public postal address for privacy and security reasons. All communications should be conducted via our contact form.

13. Children's Data Processing

14. Data Breach Notification